Privacy Policy
What personal data Avern processes, why, for how long, and how to exercise your rights.
What we collect
Account data (email, name), organization details you enter, people you register for verification (name, date of birth, nationality, residence, email), documents you upload, listings and deal-room content, and security logs (hashed IP, user agent).
Why
To verify organizations and people before they trade (legal obligation and legitimate interest), to run the marketplace and deal rooms (contract), to keep an audit trail (legal obligation), and to secure the service.
Who processes it
Avern on Supabase (database, authentication, private file storage, US-West), Vercel (hosting), Resend (transactional email), Cloudflare Turnstile (bot protection). Identity, business, and sanctions checks are performed by providers only when Avern enables them; none are enabled today.
Your rights
Organization owners can request an export or the deletion of the organization from the app (Organization → Your data). Individuals can contact privacy@useavern.com. Some records are kept without identifiers for the periods below.
Retention
Periods are drafts pending counsel; the shortest defensible period is chosen by default.
| Data | Kept for | Basis |
|---|---|---|
| Account and profile | Until deletion request | Contract |
| Organization identifiers and people | Until deletion request, then anonymised | Contract / KYC |
| Uploaded documents | Until revoked or deletion request; files removed on deletion | KYC |
| Verification decisions | 5 years after the relationship ends, without documents | AML record-keeping (LEGAL_REVIEW_REQUIRED) |
| Audit log | 5 years, anonymised after deletion | Legal obligation |
| Fee events, invoices | 7 years | Tax and accounting (LEGAL_REVIEW_REQUIRED) |
| Deal-room messages | Until the room is closed plus 5 years | Dispute evidence |
| Security logs (hashed IP) | 90 days | Security |